If you're looking at Tenable Identity Exposure, you probably want one of two things. Maybe you want something watching your domain all day and raising the alarm when an attack starts. Or maybe you want to know what's wrong with your AD and what to fix first. Tenable does both. Insight Recon sticks to the second and we built it to do that one job well.

You might know Tenable's product as Tenable.ad. It's the same thing, now branded Tenable One Identity Exposure. We make Insight Recon, so read this knowing that.

What Insight Recon actually does

On pentests, the AD tools we tried kept letting us down in the same three ways. They'd flag a mountain of stuff, skip over what to fix first and leave the fix itself to you. So we built Insight Recon to handle all three.

How we pick the checks

We don't add checks to pad a number. Every one of the 155+ is there because it's something we'd go after on a pentest or something your team needs to see. Certificate services get checks by ESC number, ESC1 through ESC17, apart from ESC12. Every check is listed in our checks library.

How we set severity

We weigh each finding against your environment before it gets a severity. Service accounts with no encryption types set are a good example.

Where to start

• Quick Wins. The fixes that cut the most risk for the least effort sit at the top of the report. They're on every plan.
• Top 10. Your ten riskiest findings, ordered by impact.
• Account Risk Scores. On paid plans, we score every account by the findings it shows up in, their severity and its privilege chain. A chain like WrongPrimaryUser → Print Operators tells you where an account's privilege comes from. Open an account and you'll see the chain next to every finding that touches it. Sorting by risk gives you the order to lock accounts down.
• Paths to Tier 0. Some findings trace a chain of control across several hops. Picture a sync account that controls a nested group, which can edit a GPO on the Domain Controllers OU. None of those hops looks like much on its own. Put them together and someone owns Tier 0. The finding lays out every hop, so you can break one and let the next scan tell you if it worked.

Fix steps for every finding

Each finding shows exactly which accounts or objects tripped it. In Hacker Insight we explain how we'd go after it on a pentest. Then you get what an admin needs to make the change:

1. What to line up before you start, like the rights you'll need and change approval
2. The fix in PowerShell, for a single object or in bulk with -WhatIf
3. The same fix as GUI steps, if you'd rather click through it
4. How to confirm it worked
5. What to do if you need an exception and what to keep as evidence

For the pre-auth finding above, validation means checking the flag is cleared and trying an AS-REP request to prove the account can't be roasted anymore. On paid plans, your next scan marks it remediated.

Tenable has fix guidance of its own, with a Recommendation section on each indicator. When Tenable launched Exposure Center in 2025, it promised “detailed remediation steps and one-click PowerShell scripts”. We've only seen it in Tenable's docs, so walk through a few real findings in your demo. Then hold them up against our sample report.

What's in your domain

On top of the findings, the report keeps an inventory of your domain:

Who reads the report

The report is our favorite part. A manager can read the score out of 100, the letter grade and the executive summary at the top and be done. Below that, whoever's doing the work gets Quick Wins, the Top 10 and the fix steps. For auditors, findings carry mappings to seven frameworks where they apply, including DISA STIG and NIST SP 800-53 Rev 5.

Open the sample report to see all 92 findings from a scan of our test domain.

Where Tenable Identity Exposure is the better product

Tenable flags risky configuration with what it calls Indicators of Exposure. It catches attacks in progress with Indicators of Attack. If anything below is a must-have for you, Tenable is probably your answer.

• Real-time monitoring. Tenable describes “continuous, real-time monitoring of Active Directory and Entra ID”. Its Trail Flow view tracks AD changes as they happen. The Entra ID side is slower, with tenant scans at least 30 minutes apart. Insight Recon only sees your domain when you scan it.
• Attack detection. Tenable's 17 Indicators of Attack include DCSync, DCShadow, Golden Ticket and Zerologon. You get alerts by email or Syslog, plus a broad REST API. Insight Recon doesn't detect attacks or send attack alerts.
• Your Entra ID tenant. Tenable reads your tenant over Microsoft Graph and Insight Recon never connects to it. Our paid hybrid checks cover the pieces Entra Connect leaves behind in on-prem AD, like the sync accounts and AZUREADSSOACC$.
• Attack paths and Tenable One. Blast Radius, Attack Path and Asset Exposure views are built in. Tenable One adds its own Attack Path Analysis and an exposure score for every asset it tracks. If you already run Tenable One, that's a good reason to keep identity there.
• Password checks. Optional Privileged Analysis reads password hashes to find blank, weak, reused and leaked passwords. Insight Recon reads configuration only and never sends password hashes anywhere.

Tenable Identity Exposure vs Insight Recon, side by side

Tenable details cover its SaaS and on-prem versions unless a row says otherwise. Confirm anything you're buying on with Tenable.

What ends up on your domain controllers

Tenable's product page calls Identity Exposure “completely agentless” and there's no agent binary on your DCs. Turn on attack detection and its setup guide asks for a good deal more.

Tenable has clearly worked to make the listener safe. It's still code on every domain controller and your change control has to sign off on it.

Rights are the other difference. Tenable monitors with a regular user. Its procedure for reading the Deleted Objects container still lists Domain Admin as the role required. Optional Privileged Analysis needs DCSync rights and Tenable says to treat that account as Tier 0. With it on, Tenable fetches LM and NT hashes. It says the hashes stay inside your network unless Tenable hosts your relay for you.

Insight Recon runs as a standard domain user from start to finish, so there's no Tier 0 service account to look after. Our SOC 2 Type 1 is done and Type 2 is underway. The security page lists exactly what's sent.

What Tenable Identity Exposure costs, as far as we can tell

Tenable doesn't publish a price for Identity Exposure. Its licensing guide says it's licensed per enabled user in your directories. You buy it through a Tenable rep or partner, either on its own or as an add-on to Tenable One.

We couldn't find a free trial. Tenable's pricing page has trials for other Tenable products. Identity Exposure gets a demo instead.

Every plan is listed on our pricing page.

• Free: $0 for one domain per company and one user. You get every core AD finding with no cap and no card needed. The hybrid identity checks come with paid plans.
• Standard: $10 per enabled account a year for the first 1,000, then $8 up to 5,000 and $6 up to 25,000. Past that we quote. The $3,000 minimum covers 300 accounts. It adds every domain and forest you own, hybrid checks, Account Risk Scores and scheduled scans. It also tracks remediation and emails you new findings after each scan.
• Enterprise: 20% more than Standard on the same steps, so $12 an account on the first 1,000. The minimum is $15,000. SSO and IP allowlisting are included. API access and air-gapped installs are quoted options.
• Auditor: $350 per client assessment with no minimum. Each assessment gives you 60 days on one client domain of any size, so you can rescan after the fixes. It's the plan for one-off client work and the reports are white-label. The partners page has the details.
• MSSP: priced per account for each managed client from our partner rate card. It's for partners who look after clients all year. You get everything in Auditor plus scheduled scans, history and new-finding alerts.

So which one should you buy?

For a team already on Tenable, there's a third option. Run both. Let Tenable watch the domain and raise the alerts while Insight Recon gives you a read-only, attacker-minded audit with fix and validation steps for every finding. Expect some overlap on the posture findings. Where the two disagree, it's worth a closer look.

Tenable Identity Exposure FAQ

Tenable facts on this page come from Tenable's own site and docs.
Product and pricing: product page · pricing page · licensing guide · Tenable One licensing.
Deployment and rights: getting started · IoA script · on-prem sizing · on-prem network flows · on-prem license · on-prem cloud activation · AD containers access · Privileged Analysis access · Privileged Analysis · Entra ID support.
Features: IoE catalogue · IoA list · ADCS indicator · IoE detail view · password indicator · Key Features guide · SaaS user guide · API reference.
Changes and naming: 2025 SaaS release notes · February 2025 press release · 2023 rename post · Alsid acquisition press release.
Products and prices change. If something here is out of date, let us know and we'll fix it. See all our comparisons.